Is ExplorerPatcher Safe? Defender, Windows Updates and Uninstall

Short answer: Is ExplorerPatcher safe? The genuine ExplorerPatcher is open-source (GPL-2.0) software whose releases are built on GitHub’s own servers, and the developers say the GitHub repository github.com/valinet/ExplorerPatcher is its “only official distribution channel.” The current stable release is 26100.8457.70.3 (June 20, 2026). It is not a virus, but it is not risk-free either: it patches File Explorer, Microsoft has named it in a known issue and blocked upgrades while it was installed, Defender flagged it for months, and the developers themselves say a Windows update can stop Explorer from starting until EP is updated. Use it on a personal PC you can recover, not on a work machine.

Where the real ExplorerPatcher lives

Every release note opens with the same warning: “This GitHub repository (valinet/ExplorerPatcher) is the only official distribution channel of ExplorerPatcher. Do not download ‘ExplorerPatcher’ from any other places than this releases page, as they may contain malware that can compromise your data.”

That rules out every other website offering the program, whatever its name or design. Our guide to fake download sites explains how lookalike pages copy open-source projects. The download link must start with https://github.com/valinet/ExplorerPatcher/releases/download/.

The project’s wiki explains how the files are made: “The public releases are never files compiled on my own computer, but rather built in a clean environment set up by GitHub.” The source code for everything in a release is public, and each release links to the GitHub Actions build that produced it.

The current release, checked

We read these values from GitHub’s releases API on September 26, 2026, and re-computed the x64 hash ourselves.

A newer pre-release exists. Version 26100.8457.70.4 was published on July 6, 2026 and is marked as a pre-release on GitHub. It restores the Windows 10 Start menu’s tile pinning on newer Insider builds and fixes a taskbar crash on 26H1 x64. Its x64 installer’s SHA-256 is 4f09eb3020029b4f507e6daa3492aa43d7b158f6cad326f4eed8f09feb6e29fa. Stay on 70.3 unless you run an Insider build that needs the fix.

ExplorerPatcher is in winget as valinet.ExplorerPatcher, but on September 26, 2026 the newest manifest there was 22631.5335.68.2, well behind the current release. Download from GitHub instead.

Why antivirus software has flagged it

The developers’ explanation, from the project wiki: detections usually come from heuristics, not a database of known viruses. “Injecting code into other executable programs is rarely done by legitimate programs. One such kind of legitimate programs is this patcher, that you deliberately choose to run and let it alter Explorer’s code and memory in a controlled manner.”

Microsoft’s own threat encyclopedia has an entry named HackTool:Win64/ExplorerPatcher!MTB, published May 3, 2024. A “HackTool” detection describes what a program can do, not proof that it is malware. For a long stretch, release notes told users to add Defender exclusions just to install and uninstall it.

That has changed. The current release notes say: “Windows Defender no longer flags ExplorerPatcher. It is no longer needed to configure Defender exclusions.” The project’s FAQ page still carries an older warning that Microsoft and other vendors flag it, so the documentation is inconsistent. Go by the current release notes, and check your own Defender result.

Third-party security tools may still react. The notes list folders to exclude, including C:\Program Files\ExplorerPatcher, %APPDATA%\ExplorerPatcher and C:\Windows\dxgi.dll, and warn that “explorer.exe will not start if this file exists but is blocked from being loaded.” Only add exclusions for a file whose hash you have checked against the GitHub release.

What Microsoft has done about ExplorerPatcher

Microsoft has acted on ExplorerPatcher twice in ways that affected users directly.

• February 2023, update KB5022913. Microsoft’s support article listed a known issue: “After installing this or later updates, Windows devices with some third-party UI customization apps might not start up.” It named ExplorerPatcher and StartAllBack and said such apps use “unsupported methods.” The article later noted both apps had released versions that resolve the issue.
• Windows 11 24H2 upgrade blocks. ExplorerPatcher’s November 2024 release notes said: “When updating to 24H2, please uninstall EP before starting the update… Due to explicit blocks by Microsoft, the update cannot proceed if EP is installed.” A May 2025 release renamed one component, ep_dwm.exe, to ep_dwm_svc.exe “to get around 24H2 upgrade blocks.”

Both episodes show the same thing: Microsoft does not support ExplorerPatcher, and a Windows change can break it without warning. Plan for that.

Compatibility with Windows 11 24H2 and 25H2

Release 70.3 lists the builds it was tested on: 22621.4317, 22631.7079, 26100.6899, 26100.8037, 26200.8246, 26200.8457, 26300.8493 and 28000.2113. Builds starting 26100 are Windows 11 24H2, 26200 is 25H2 and 28000 is 26H1, per Microsoft’s release information. If you are still on 24H2 Home or Pro, it stops getting updates on October 13, 2026; see our 24H2 end-of-support guide.

Two things work differently on current Windows 11:

• The Windows 10 taskbar. The FAQ says: “In 24H2, Microsoft removed the Windows 10 taskbar.” ExplorerPatcher now ships its own reimplementation, but does not make it the default “due to potential compatibility concerns in the future.” You enable it in Properties.
• The Windows 10 Start menu. The 70.3 notes say newer builds removed parts of it, so the option was hidden on those builds; the 70.4 pre-release restores tile pinning.

Earlier release notes, from 2025, were direct about the risk: “We DO NOT recommend using the Windows 10 (ExplorerPatcher) taskbar on work and mission-critical machines. Microsoft’s monthly cumulative and ‘security’ updates… can cause Explorer to be unstable or fail to start at all if EP has not been updated accordingly.”

Is ExplorerPatcher safe to install? Check these first

• Turn off Smart App Control first. The release notes warn that otherwise “there is a risk where explorer.exe would not start up on new EP versions.”
• Don’t install it alongside SentinelOne. The developers report that SentinelOne “can hold EP’s files hostage, preventing uninstallation.”
• Pick the right installer. ep_setup.exe for Intel or AMD processors, ep_setup_arm64.exe for Snapdragon.
• Verify it. Run Get-FileHash .\ep_setup.exe in PowerShell and compare the result with the hash in the table above.
• Keep it updated. Because Windows updates can break it, use the built-in updater under Properties > Updates, or install each new release from GitHub.

Our ExplorerPatcher download page links to the official release and keeps the hashes current.

If your screen goes black

The project’s FAQ gives a recovery method that starts Explorer without ExplorerPatcher:

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Select Run new task (or File > Run new task).
3. Type explorer.exe.
4. Hold Ctrl+Alt+Shift, press Enter, and keep holding until the taskbar appears.

From there you can switch the taskbar back to the default style or uninstall.

How to uninstall ExplorerPatcher cleanly

The installer wiki lists five ways. Use whichever is available:

1. Right-click the taskbar, choose Properties, go to Uninstall and click Uninstall ExplorerPatcher. You can also find “Properties (ExplorerPatcher)” in Start > All apps.
2. Settings > Apps, find ExplorerPatcher, and choose Uninstall.
3. Control Panel > Programs and Features, select ExplorerPatcher and choose Uninstall.
4. Run ep_setup.exe /uninstall.
5. Rename ep_setup.exe to ep_uninstall.exe and run it.

If uninstalling fails, a security tool is often holding the files. Check it for quarantined ExplorerPatcher items, then try again. Restart when you are done.

If you want a different way to customize Windows, Windhawk takes a mod-based approach; the ExplorerPatcher FAQ itself points 7+ Taskbar Tweaker users to Windhawk mods.

Questions

Is ExplorerPatcher malware?

No. It is open-source, built on GitHub’s servers and published only on its GitHub releases page. Security tools have flagged it because it injects code into Explorer, which malware also does.

Does Windows Defender still flag ExplorerPatcher?

The current release notes say Defender no longer flags it. Third-party antivirus tools may still need exclusions.

Is explorerpatcher.net the official site?

The developers say the GitHub repository is the only official distribution channel, so no other website is official. We have not found a developer statement about that specific domain.

Will ExplorerPatcher block Windows updates?

It has before. In 2024, Microsoft blocked 24H2 upgrades on PCs with it installed, and the developers told users to uninstall it first. A 2025 release changed a component name to get around that block.

Does ExplorerPatcher work on Windows 11 25H2?

Release 70.3 was tested on 25H2 builds 26200.8246 and 26200.8457. Some Windows 10-style features depend on what each Windows build still contains.

Why is there no Windows 10 taskbar after installing on 24H2?

Microsoft removed it in 24H2. Enable ExplorerPatcher’s own taskbar implementation in Properties.

Is ExplorerPatcher free?

Yes. It is licensed under GPL-2.0. The developers accept donations through GitHub Sponsors.

Should I use ExplorerPatcher on a work PC?

No. The developers advise against using the EP taskbar on work and mission-critical machines, and most employers’ security tools will object.

Sources

• valinet/ExplorerPatcher repository and README, GitHub (checked September 26, 2026)
• Release 26100.8457.70.3, 26100.8457.70.4 (pre-release), 22631.5335.68.2 and 22621.4317.67.1, GitHub
• Antivirus false positives, Frequently asked questions and Installer How To, ExplorerPatcher wiki
• HackTool:Win64/ExplorerPatcher!MTB, Microsoft Security Intelligence
• February 28, 2023, KB5022913 (OS Build 22621.1344) Preview, Microsoft Support
• Windows 11 release information, Microsoft Learn